First Response
The first responder's mandate
A first responder protects people first, then property and evidence. Priorities in order: life and safety, preventing further damage, preserving evidence, documenting everything, and notifying the right people. The first responder is generally not the forensic examiner - the job is to secure, stabilise and record, not to deliver a full analysis.
Order of volatility
The classic trap. Collect most volatile first (RFC 3227): CPU registers and cache → RAM and running system state → network configuration and connections → running processes and open files → temporary files → disk/storage → remote logs and monitoring data → archival/backup media. Corollaries exam questions love: do not power off a machine unless there is a documented reason (you lose RAM); do not run the suspect's own binaries (use trusted, portable tools from write-protected media); capture RAM before pulling the drive; be aware that pulling the plug is different from a clean shutdown (a clean shutdown writes to disk and destroys evidence).
Handling digital evidence
Preserve the chain of custody - who had it, when, where, why, and what was done. Use write blockers on storage, compute hashes at acquisition (MD5/SHA-256) and re-verify later, image rather than work on originals, and store evidence in tamper-evident, access-controlled conditions. Document the scene: photographs, system state, logged-on users, time offset/clock skew between host and reference clock, and network topology.
Legal and policy guardrails
You need authorisation before seizing or imaging equipment. Respect privacy law, employee policy, and jurisdiction. Handle privileged material (e.g., HR files, legal communications) carefully; involve legal early.
Worked example: a workstation is suspected of beaconing to a C2. Rather than shutting it down, isolate it at the switch/EDR, capture memory and network state, record netstat/arp/process list from trusted media, photograph the screen, hash the disk image, then hand over to the investigation team.